Turla’s Cereal malware turns victims’ Exchange servers into spy hubs

Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow. ESET researchers found the malware and named it Cereal. The toolset doesn’t need an attacker-owned server.

Summary from Help Net Security.

Related coverage

Other sources covering the same vulnerabilities or event.

More in Threat Intel